General

  • Target

    ffd67d129ac06ebe247a7582b6a1a7a523abe7be94960ac81846fcfe1aa61d7b

  • Size

    2.0MB

  • Sample

    210504-x9nwnsl85x

  • MD5

    d46c69d5869fb36f52a79f46c08ee7cc

  • SHA1

    53fb5fb2011e2353f5e60afd75a6d11fb6cac6cf

  • SHA256

    ffd67d129ac06ebe247a7582b6a1a7a523abe7be94960ac81846fcfe1aa61d7b

  • SHA512

    1e6a362f9d428252f02f8f9d8737d327d42c9e5a493597d18781acfc2d016e66ac6b6c24443f217f9966e43bcb1c041add1f754a044f0b0f5e79720ff4afe7ff

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx107

Campaign

1588082813

C2

97.81.255.189:443

67.8.103.21:443

47.232.26.181:443

50.104.67.101:443

173.172.205.216:443

108.188.46.240:995

96.35.170.82:2222

70.95.94.91:2222

72.204.242.138:6881

72.231.224.122:2222

73.137.187.150:443

73.123.16.215:443

71.213.29.14:995

209.182.121.133:2222

82.210.157.185:443

69.47.26.41:443

86.122.7.89:443

71.187.170.235:443

79.113.46.93:443

74.134.4.236:443

Targets

    • Target

      ffd67d129ac06ebe247a7582b6a1a7a523abe7be94960ac81846fcfe1aa61d7b

    • Size

      2.0MB

    • MD5

      d46c69d5869fb36f52a79f46c08ee7cc

    • SHA1

      53fb5fb2011e2353f5e60afd75a6d11fb6cac6cf

    • SHA256

      ffd67d129ac06ebe247a7582b6a1a7a523abe7be94960ac81846fcfe1aa61d7b

    • SHA512

      1e6a362f9d428252f02f8f9d8737d327d42c9e5a493597d18781acfc2d016e66ac6b6c24443f217f9966e43bcb1c041add1f754a044f0b0f5e79720ff4afe7ff

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks